Submission Details
Severity:
Wrong event param used in RAACMinter.sol::mintRewards()
Summary
The emitted event will give false data of how many RAACs were minted.
Vulnerability Details
function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
uint256 toMint = excessTokens >= amount ? 0 : amount - excessTokens;
excessTokens = excessTokens >= amount ? excessTokens - amount : 0;
if (toMint > 0) {
raacToken.mint(address(this), toMint);
}
raacToken.safeTransfer(to, amount);
// @audit wrong param used, should be toMint
emit RAACMinted(amount);
}
It emits with amount instead of toMint, which makes it to report false data.
Impact
Off chain applications and Dapps relie on informations given by events, this could lead to several problems in applications, misleading the end user.
Tools Used
Manual
Recommendations
function mintRewards(address to, uint256 amount) external nonReentrant whenNotPaused {
if (msg.sender != address(stabilityPool)) revert OnlyStabilityPool();
uint256 toMint = excessTokens >= amount ? 0 : amount - excessTokens;
excessTokens = excessTokens >= amount ? excessTokens - amount : 0;
if (toMint > 0) {
raacToken.mint(address(this), toMint);
}
raacToken.safeTransfer(to, amount);
// @audit wrong param used, should be toMint
- emit RAACMinted(amount);
+ emit RAACMinted(toMint);
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
RAACMinter.mintRewards() emits incorrect event value when called
suggestion is something that is done by ERC20.mint() function
Appeal created
inallhonesty 3 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
RAACMinter.mintRewards() emits incorrect event value when called
suggestion is something that is done by ERC20.mint() function
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.